Jean-Denis Greze fled a tax trap for an unworkable security bet
By Nikhil Raghavan · Reporting from San Francisco ·
Jean-Denis Greze was right to abandon a small-business tax startup, but treating autonomous inbox agents like consumer software ignores the deterministic security controls required to survive an enterprise audit.
Walking away from a company generating revenue in its first year, on track to grow in its second, sounds like madness or financial malpractice. Yet on a recent episode of the a16z podcast, Jean-Denis Greze, the former chief technology officer of Plaid, explained to partner Alex Rampell why he killed his automated small-business tax startup cold. The software worked, but the distribution math was terminal. Tax returns are filed once a year, offer zero daily active usage, and generate virtually no word-of-mouth. Incumbents, Greze realized, could ship an API wrapper to their existing millions of small-business accounts long before a fledgling startup could acquire them.
The distribution clock runs faster than compute
Greze’s post-mortem on tax automation is the sharpest analysis of applied machine learning you will hear this year. Most founders confuse a solvable technical problem with an executable business model. A small-business tax return is structured data wrapped in legal text—the exact workload an LLM handles competently. But an annual purchase cadence means an acquisition window that shuts quickly. If your customer acquisition cost collides with a long dormancy period, your unit economics collapse under customer churn. Incumbents with established pipelines do not need superior models; they merely need to deploy marginal compute against the customers they already bill every month.
Recognizing that reality took guts. Greze pivoted his company, Town, into an artificial intelligence assistant operating directly inside user calendars and inboxes. His core premise, echoed by Rampell, is that software must start with product-led consumer delight rather than enterprise IT requirements. Greze cited his years at Dropbox to argue that an engineering team can always retrofit enterprise compliance onto a beloved consumer product. Building for the corporate security officer from day one guarantees a clunky, unadoptable tool.
The fatal error in retrofitting compliance
Here is where the engineering spec diverges from the venture pitch. Dropbox was dumb storage. Syncing a byte stream to an S3 bucket under an enterprise license requires disk encryption, identity federation, and basic tenant isolation. It does not alter how the file system writes blocks.
An autonomous agent operating inside an executive’s inbox is an entirely different architecture. It is an unsupervised service account granted read, write, and semantic parsing privileges over an organization’s most sensitive communications. Greze envisions Town mediating company-wide knowledge, letting agents query colleagues’ inboxes to surface internal connections without human latency. But in production systems, access control is deterministic, while language models are probabilistic. You cannot simply bolt role-based access control and tenant-level data governance onto an agent framework after the fact.
When Rampell compared the shift to CEOs forcing IT departments to accept the original iPhone in 2007, he misidentified the mechanism. The iPhone was an isolated hardware client speaking standard Exchange ActiveSync. It did not autonomously scrape and correlate unredacted executive correspondence across corporate directories. If a mobile sandbox fails, an employee wipes a lost handset. When an inbox-scraping agent misroutes privileged acquisition notes or leaks executive compensation data through an indirect prompt injection, who answers the page at three in the morning? It will not be the venture partners cheering the product-led growth metrics; it will be the chief information security officer facing a regulatory subpoena.
Autonomy without guardrails is unsellable
Greze argued that the competitive edge in artificial intelligence will come from removing humans from the routing loop entirely. Models should automate decisions at machine speed because the economic gains dwarf the risks.
That thesis is sellable on Sand Hill Road, but it is not shippable to any enterprise that must survive an external audit. The historical pattern of enterprise infrastructure is absolute. Systems handling core corporate context either establish zero-trust boundaries at the data ingestion layer, or they face crippling liability when their boundary checks fail at scale. Trusting probabilistic agents to autonomously determine what internal data can cross employee boundaries is not forward-thinking; it is an operational failure waiting for an incident report. If autonomy cannot provide verifiable, audit-logged isolation before it ingests the company’s mail spool, enterprise software buyers will not whitelist the product—they will terminate its API tokens.